AML/CTF Tranche 2 Is Live: What Accounting and Legal Practices Are Finding in the First Weeks

AML/CTF Tranche 2 came into force on 1 July 2026. Accountants, lawyers, conveyancers and other gatekeeper professions are now subject to the same anti-money laundering obligations that have applied to banks and financial institutions for years.

Most firms enrolled with AUSTRAC ahead of the deadline. Fewer had worked out what the obligation looks like on a Tuesday afternoon, three weeks in, when a new client needs onboarding and someone has to actually run the checks.

What Changed on 1 July

Before this year, AML/CTF obligations applied to banks, remittance providers and a handful of other regulated sectors. From 1 July, the regime extended to professional designated services, which pulls in a wide range of accounting and legal work that firms have always done but never had to document this way.

The core requirements are consistent across the newly regulated professions: identify and verify clients, understand the purpose of the relationship, assess and rate risk, keep records for seven years, and report certain transactions or suspicious activity to AUSTRAC. The concepts are the same ones banks have worked to for years. The change is that accounting and legal practices now have to evidence them, on file, for every applicable client and matter.

Penalties for non-compliance are set at a level designed to be taken seriously. Corporate penalties can reach into the tens of millions of dollars, and individual practitioners can also be held accountable. That’s the backdrop firms are now operating under.

Which Services Are Actually Captured

Not every accounting or legal service is a designated service under the Act. AUSTRAC’s guidance sets out which specific activities trigger the obligation, and the list is more precise than most firms expected.

Broadly, it captures services where a practitioner is managing money or assets on a client’s behalf, or facilitating transactions that could be used to move funds: trust and company formation, certain conveyancing-adjacent work, managing client funds, and advice connected to buying or selling businesses or real property.

Routine tax return preparation, standard bookkeeping and general advisory work generally sit outside the designated services list. The practical problem for most firms is that a single client relationship can span both captured and non-captured work, which means the obligation applies matter by matter, not client by client.

A firm might run standard compliance work for a client all year and then take on a business sale for the same client in October. October’s engagement is captured. The rest of the relationship isn’t. Firms that treat AML/CTF as a blanket policy applied at intake miss this distinction and either over-apply the obligation to work that doesn’t need it, wasting time, or under-apply it to a matter that does, creating genuine exposure.

Where the Admin Load Lands in Practice

In firms that enrolled early, the pattern is consistent. A partner or senior practitioner owns the compliance program on paper. In practice, the actual work of collecting identification documents, verifying beneficial ownership, running risk assessments and keeping the client register current lands on whoever has the least defended calendar.

That’s usually a graduate accountant, a paralegal, or an office manager who was already stretched before this obligation existed. The work is repetitive, detail-heavy, and easy to fall behind on when a busier week arrives.

The Recurring Tasks Nobody Budgeted For

Once a firm has an AML/CTF program in place, the ongoing admin looks like this:

• Collecting and verifying photo ID and proof of address for every new client in a captured matter, and re-verifying when documents expire
• Running beneficial ownership checks on trusts and companies, including tracing ownership through layered structures
• Applying the firm’s risk rating criteria to each new matter and recording the reasoning
• Maintaining the client register with current status, next review date, and outstanding documentation
• Preparing files for internal or AUSTRAC review, including pulling together the evidence trail for a specific matter on request
• Monitoring for transactions or client behaviour that meets the threshold for a suspicious matter report, and escalating to the person authorised to lodge one

None of these tasks require a CPA or a law degree. All of them require consistency, because AUSTRAC assesses a program on how it holds up during a busy week, not on how it reads during a quiet one.

Building a Process Instead of a Manual Response

Firms that are coping well with Tranche 2 three weeks in have one thing in common: someone owns the recurring admin as an actual job, with a checklist and a rhythm, rather than treating each new client as a one-off task to squeeze in.

That looks like a standard onboarding checklist that runs the same way every time, a register that’s updated the day documents arrive rather than the week before a review, and a clear escalation point when something looks unusual. The senior practitioner still makes the risk-rating and reporting decisions. What changes is that the document collection, verification, and register maintenance stop competing for the same hours as client-facing work.

In practice, this often means splitting the work into two clear tiers. Tier one is standard onboarding: individual client, straightforward structure, no red flags on the initial screen. This can run almost entirely on a checklist, with a fixed set of documents to collect and a standard risk rating to apply once verification is complete. Tier two is anything with layered ownership, an offshore connection, a cash-intensive business, or a politically exposed person involved. That work still starts with the same document collection process, but the risk assessment and any escalation decision moves straight to the senior practitioner. Firms that draw this line clearly find the bulk of their onboarding volume, which is almost always tier one, becomes genuinely easy to delegate.

Where Offshore Support Fits

This is exactly the kind of work that suits a dedicated offshore specialist working under clear instructions from the licence holder. An AML/KYC documentation coordinator can own the onboarding checklist, chase outstanding identification documents, run beneficial ownership searches, keep the client register current, and assemble evidence files ahead of a review, all under a documented process the firm designs upfront for professional services businesses.

The risk-rating decisions, the suspicious matter report judgement calls, and the regulatory relationship stay exactly where they belong, with the practitioner who holds the licence. What moves offshore is the volume work that currently eats into billable hours or gets deferred until it becomes a problem.

If your firm is now three weeks into Tranche 2 and already feeling where the admin is landing, that’s the moment to design the role properly rather than let it default to whoever has the most patience.

Book a Connect Session